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POWER PROVISION BASED ON 
SELF-SACRIFICING CRAFT 

CROSS-REFERENCE TO RELATED 

APPLICATION 5 

The present application is a continuation-in-part of U.S. 
patent application Ser. No. 12/569,422, filed Sep. 29, 2009 
now U.S. Pat. No. 8,275,724, which in-tum claims a benefit 
from prior U.S. patent application Ser. No. 61/105,474, filed 10 
Oct. 15, 2008, each of which is incorporated herein in its 
entirety by reference. 

STATEMENT OF GOVERNMENT INTEREST 

15 

The invention described herein was at least in-part made by 
an employee of the United States Government and may be 
manufactured and used by or for the Government of the 
United States of America for governmental purposes without 
the payment of any royalties thereon or therefor. 20 

FIELD 

The present invention relates generally to the field of arti- 
ficial intelligence, to architecture for collective interactions 25 
between autonomous entities, and to the conservation of 
resources in an autonomous system. 

BACKGROUND 

30 

Future space probes that operate in cooperative swarms 
must self-sacrifice if they begin to fail and risk damaging their 
neighbors in the swarm. Swarm-based missions may be the 
wave of the future, whereby space exploration is undertaken 
not by one large spacecraft but by swarming formations of 35 
much smaller, cheaper ones. Such smaller spacecraft could 
collectively provide a “floating optics” system for a space 
telescope comprising, for example, separate spacecraft flying 
in formation. In such a system, however, if one spacecraft in 
the swarm begins to fail and risks a calamitous collision with 40 
another, it must sense its end is nigh and put itself on a course 
that takes it forever away from the swarm, for the greater good 
of the collective. Failing that, perhaps because it has too little 
fuel to move away, it must “passivate” itself by deactivating 
all its systems . This would mean discharging its batteries so as 45 
to pose no risk of shock in a collision, and venting any last 
vestiges of fuel that could explode in a crash. Then its neigh- 
bors would be programmed to navigate around the lifeless 
satellite. When certain failure modes are sensed, the craft 
must self-sacrifice voluntarily by transformation or self-de- 50 
struction. This is analogous to the way bee colonies operate, 
with the workers cooperating to ensure that the mission, that 
is, reproduction by the queen, succeeds at all costs, even at 
their own peril. 

The common goals of much contemporary software devel- 55 
opment are related to quality, flexibility, security, and exploit- 
ing emergent behavior, which imply an inherent need for 
self-management and self-monitoring. There are many 
examples of emergent behavior in the insect world. For 
example, when it gets cold, the worker bees gather around the 60 
queen bee to warm her with the heat of their bodies, resulting 
in some of them freezing to death. In another example, bee 
stingers are a relatively strong defense mechanism for pro- 
tecting a hive, but whenever a bee stings, it dies. Inyet another 
example, the soldier termites defend the colony by blocking 65 
the tunnels with their body. Usually more soldiers stand by 
behind the initial soldier so once the first one falls, another 
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soldier will take his place. In the case that the intrusion is 
coming from a laige breach that cannot be blocked by a single 
soldier, more solder termites form a phalanx-like formation 
that blocks the entire breach, until the latter is repaired by 
other termites. 

In human beings, the self-destruction behavior of human 
body cells is considered as an intrinsic safety mechanism of 
the human body. It seems that the lifetime of a cell is pro- 
grammed and that cells know when to commit suicide. This 
self-destruction is an intrinsic property that can be delayed 
due to the continuous receipt of biochemical reprieves. This 
process, also known as “death by default”, or apoptosis, pre- 
vents cells from dying due to constant receipt of biochemical 
“stay alive” reprieve signals. Investigations into the apoptosis 
process have discovered that whenever a cell divides, it com- 
mits suicide due to lack of reprieve signals. It is believed that 
the reason for this is self-protection, as the most dangerous 
time for the body is when a cell divides, since if just one of the 
billions of cells locks into division the result is a tumor. 

Moreover, metamorphosis and transformation processes 
are observable in different species. Metamorphosis is a bio- 
logical process whereby a living organism physically changes 
its form or structure during development. Perhaps the most 
notable form of metamorphosis is the transformation from the 
immature insect into the adult form. Another form of meta- 
morphosis is observed in chameleons, which are famous for 
their ability to change their skin color to blend in with their 
surroundings. 

Furthermore, there are living organisms called sequential 
hermaphrodites (or dichogamy) which are organisms born as 
one sex and which then later change into the other sex. A few 
species in this group can change gender multiple times, but 
they can only function as one sex at a time. Unlike humans, 
the DNA of these species does not detennine their gender, 
allowing fLill functional gender change without modifying the 
DNA. 

It should be understood that emergence is not about com- 
plexity and simplicity, but is more about features that, being 
not present at a local level, appear at a global level, but whose 
uncontrolled appearance may result in greater levels of com- 
plexity. 

Biologically-inspired computing adopts biological 
approaches to effective problem solving, where solutions 
developed by nature through millions of years of evolution 
are applied in the computing milieu. 

Sterritt and Hinchey describe self-destruction in agent- 
based systems as a last resort situation to prevent further 
damage that can be due to race conditions or undesirable 
emergent behavior. In their approach, they propose an apop- 
tosis “stay alive” construct used to confirm that if an agent is 
still within the correct context and behavior it should stay 
alive and not self-destruct. See, R. Sterritt and M. G. Hinchey, 
“Apoptosis and Self-Destruct: A Contribution to Autonomic 
Agents?”, Proc. FAABS-III, 3rd NASA/IEEE Workshop on 
Formal Approaches to Agent-Based Systems, Greenbelt, M D, 
Springer Verlag (2005), which is incorporated herein in its 
entirety by reference. 

Hartline describes a premature termination of a mobile 
agent from a malicious host in order to facilitate security 
measures. See, J. D. Hartline, Mobile Agents: A Survey of 
Fault Tolerance and Security. University of Washington, 
(1998), which is incorporated herein in its entirety by refer- 
ence. 

Chapelle et al. propose an architecture of cooperative 
agents where, due to a satisfaction model and local signals, 
agents learn to select behaviors that are well adapted to their 
neighbor’s activities. See, J. Chapelle, O. Simonin, and J. 
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Ferber, “Flow Situated Agents can Learn to Cooperate by 
Monitoring their Neighbors’ Satisfaction”, In Proc. of the 
15 th European Conference on Artificial Intelligence, 2002, 
pp. 68-72, which is incorporated herein in its entirety by 
reference. 5 

Research into the self-sacrifice behavior of living species is 
currently being conducted at University of Cambridge, where 
researchers have developed a computer defense system that 
mimics how bees sacrifice the elves for the greater good of the 
hive. In this approach, “suicide nodes” defend networks from to 
within. The idea is to give all the devices on a network, or 
nodes, the ability to destroy themselves, and take down any 
nearby malevolent devices with them. The self-sacrifice pro- 
vision provides a defense against malicious nodes attacking 
clean nodes. The technique, called “suicide revocation,” 15 
allows a single node to decide if a nearby node’s behavior is 
malevolent, and if so, to shut it down, but at the cost of 
deactivating itself. Often, at the time an autonomous device 
receives or generates a self-sacrifice or shut-down signal, it 
still has good, valuable, and relatively nearby resources or 20 
assets that would be destroyed during a self-sacrifice opera- 
tion. 

SUMMARY 

25 

The present teachings relate to recovering resources or 
assets from a self-sacrificing component of an autonomous 
system, of which resources or assets would otherwise be 
destroyed during a self-sacrifice operation. As such, a receiv- 
ing component of the system can benefit from a power pro- 30 
vision donated by a self-sacrificing component of the system. 
Robotic vacuum cleaners have been developed that can seek 
out power sources when their battery power is low, and even 
comiect themselves to that power source for recharging. 
Refueling of aircraft in the air is commonplace in military 35 
applications, but is limited to fuel rather than recharging and 
involves a specialized component carrying fuel solely for the 
purpose of refueling. The present teachings, however, relate 
to components of an autonomic system, which donate a 
power provision (battery, fuel, solar panel, or the like) to 40 
another component of the autonomic system, to ensure the 
continued operation of the receiving component, even at the 
cost of self-sacrifice. 

While earlier filed and related U.S. patent application Ser. 

No. 12/569,422 teaches that elements of a swarm may self- 45 
destruct or put themselves in a passive mode in order to ensure 
the survival of the main part of the swarm, the present teach- 
ings also enable elements of the swami to give up their 
resources, assets, or power provisions to ensure the swarm 
survives. In an exemplary embodiment, a swarm element is 50 
configured to “donate” its power provision to another element 
of the swarm, for example, prior to a self-destruct operation. 
Moreover, multiple elements of the swarm may be able to 
donate their respective power provisions to a key element of 
the swarm by attaching themselves, for example, either 55 
directly or as a daisy chain, to the key element. 

According to various embodiments of the present teach- 
ings, a method for managing an autonomic system is pro- 
vided. The autonomic system can comprise a plurality of 
autonomic components and the method can comprise gener- 60 
ating a signal indicative of a triggering event pertaining to one 
or more faulty autonomic components of a plurality of auto- 
nomic components. The method can comprise performing a 
self-evaluation to determine whether the self-sacrificing 
component has any salvageable resources available that 65 
might benefit another component of the system. If so, the 
self-sacrificing operation may be postponed, suspended, 
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delayed, or otherwise put-off until the self-sacrificing com- 
ponent has donated the salvageable resources. In the event 
that one component of an autonomous system is determining 
whether its salvageable resources can be donated, the com- 
ponent may determine whether the resource is compatible 
with a different component of the system, for example, with a 
different component that is within range for a rendezvous. If 
it is determined that there are no salvageable resources avail- 
able, or that there is no other system component within range 
for rendezvous and that is compatible with an available 
resource, then the self-sacrificing component may carry on 
with self-sacrifice despite not having been able to donate a 
useable resource. 

The autonomic components of the system can comprise, 
for example, space exploration vehicles or deep sea explora- 
tion vehicles. One or more autonomic components of the 
system can individually comprise one or more magnetom- 
eters, X-ray analyzers, infrared analyzers, mass spectrom- 
eters, photodiode-containing detectors, combinations 
thereof, and the like. The method can comprise undertaking a 
self-sacrifice operation upon a triggering event such as: an 
incorrect operation; a determination of likelihood of jeopar- 
dizing a primary objective; a failure to perform a self-con- 
figuration operation; a failure to perform a self-healing opera- 
tion; a failure to perform a self-optimizing operation; and a 
failure to perform a self-protecting operation. 

Self-sacrifice can also involve donating a resource or asset 
to another component of the system, even if the donating 
component is working perfectly fine, but wherein the dona- 
tion would enable the receiving component to carry out a 
more important task or mission for the benefit of the greater 
system. For example, a more important component of an 
autonomous system, such as a more important spacecraft, can 
receive or generate a need for resource signal. The resource 
needed can be, for example, a power provision. A less impor- 
tant component of the system, such as a less important space- 
craft, can then be contacted or interrogated to determine if it 
has a corresponding resource available. If not, the more 
important component of the system can continue to search for 
the needed resource, for example, by contacting or interro- 
gating other less important components of the system. If a less 
important component of the system does have the needed 
resource available, then the method can involve self-sacrific- 
ing the less important component, at least to the extent that it 
donates the needed resource, so that the more important com- 
ponent can receive the needed resource. In some cases, the 
method can involve determining whether the resource avail- 
able from a less important component is compatible with the 
more important component. In some cases, the method can 
involve determining whether the less important component 
and the more important component are capable of a rendez- 
vous, for example, whether they have compatible docking 
comiections, whether they are in close enough proximity, or 
whether the risk involved with a rendezvous is too great to be 
worthwhile. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present teachings will be described with reference to 
the accompanying drawings. The drawings are intended to 
illustrate, not limit, the present teachings. 

FIG. 1 is a diagram depicting the ANTS concept mission 
scenario according to various embodiments of the present 
teachings. 

FIG. 2 depicts the multi-tier specification model of ASSL 
(Autonomic System Specification Language) according to 
various embodiments of the present teachings. 



US 9,171,266 B2 


5 

FIG. 3 depicts a partial specification of a self-sacrifice 
policy according to various embodiments of the present 
teachings. 

FIG. 4 depicts a partial specification of exemplary actions 
included in a self-sacrifice policy according to various 5 
embodiments of the present teachings. 

FIG. 5 is a flow chart showing various steps involved with 
an exemplary method of the present teachings, wherein a 
component of an autonomous system, which has received or 
generated a quiesce or self-sacrifice command, is evaluated to to 
determine whether the component has resources that can be 
donated to one or more other components of the system, 
before the quiesce or self-sacrifice function is carried out. 

FIG. 6 is a flow chart showing various steps involved with 
another exemplary method of the present teachings, wherein, 1 5 
once a first spacecraft generates a self-destruct command it is 
evaluated to determine whether it has a salvageable power 
provision that can be donated to a second spacecraft before 
the first spacecraft self-destructs. 

FIG. 7 is a flow chart showing various steps involved with 20 
an exemplary method of the present teachings, wherein a 
more important component of an autonomous system has 
received or generated a need for resource signal, and a less 
important component is evaluated to determine whether the 
less important component can be self-sacrificed to donate a 25 
needed resource to the more important component of the 
system. 

FIG. 8 is a flow chart showing various steps involved with 
another exemplary method of the present teachings, wherein 
a more important spacecraft of an autonomous system gen- 30 
erates a need for a power provision signal, and a less impor- 
tant spacecraft of the autonomous system is evaluated to 
determine whether it can be self-sacrificed to donate a power 
provision and fill the need of the more important a spacecraft. 

35 

DETAILED DESCRIPTION OF THE PRESENT 
INVENTION 

The present teachings enable elements of the system or 
swarm to give up their resources to ensure the overall system 40 
or swarm survives. In an exemplary embodiment, a swarm 
element is configured to “donate” its power provision, or 
another resource or asset, to a different element of the system 
or swarm, for example, prior to a self-destruct operation. 
Moreover, multiple elements of the swarm may be able to 45 
donate their respective power provisions to a key element or 
to another, more important element of the swarm by attaching 
themselves to the key element. Attachment can be, for 
example, directly to the key element, as a daisy chain series 
attached to the key element, by attaching only the donated 50 
power provisions to the power source of the key element, or 
the like. 

Self-sacrifice can comprise, for example, shutting down, 
self-destruction, or the like. Self-destruction can be, for 
example, by explosion, by implosion, by steering into an 55 
asteroid, planet, sun, or by shuttling off into space. Prior to 
such self-sacrifice, however, the present teachings provide for 
the transfer of a resource or asset, for example, a power 
provision, from the self-sacrificing component to another 
component of the system that would benefit from receiving 60 
the resource or asset. 

According to various embodiments of the present teach- 
ings, a death-by-default system is used in a multi-agent auto- 
nomic system as a means of ensuring the safety and security 
of the multi-agent autonomic system. The multi-agent auto- 65 
nomic system can comprise a swarm of spacecraft, a plurality 
of unmanned vehicles, a plurality of unmanned aerial 
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vehicles, a multi-component communications system, a 
swarm of underwater crafts, a swarm of unmanned underwa- 
ter crafts, a plurality of robots, a constellation of satellites, or 
the like. The present teachings also find application in swarm- 
based exploration missions in space, swarm-based explora- 
tion missions underwater, swann -based exploration missions 
on a planetary surface, other exploration missions, robotics, 
robotics in harsh environments that are not easily tended by 
humans, search-and-rescue management, other emergency 
management, smart grids, mobile applications, sensor tech- 
nology, future internet (an internet of things), and the like. 

Based on the principle of apoptosis, in which cells in nature 
are pre-programmed to die unless they receive a chemical 
reprieve, components in the present systems are pre-pro- 
grammed to go offline unless a suitable reprieve signal, for 
example, a digital reprieve signal, is received. The present 
teachings provide a system wherein, when a component of the 
autonomic system is exhibiting faulty behavior, the compo- 
nent can be limited in the damage it can cause to the rest of the 
system, or be limited in the extent of influence it can exert on 
the rest of the system. Hie faulty behavior can comprise 
failing to respond appropriately to requests, being an unnec- 
essary drain on resources, exhibiting signs indicating that the 
integrity of the component has been compromised, or raising 
suspicion of being an invalid interloper to the system. Once 
such faulty behavior is recognized, the component can either 
be deprived of a reprieve signal on a permanent basis, or on a 
temporary basis. If temporarily deprived of a reprieve signal, 
the component can be put in a quiescent mode until it can be 
verified as a valid component operating as expected, it can be 
verified as being faulty, or some other remedial action has 
been taken. 

Previous technologies that describe apparatus, systems, 
methods, and autonomic components that can be used in 
accordance with the present teachings include the technolo- 
gies described in U.S. Pat. No. 7,627,538 B2, U.S. Pat. No. 
7,899,760 B2, U.S. Pat. No. 7,904,396 B2, U.S. Pat. No. 
7,925,600 B2, and U.S. Pat. No. 7,765,171 B2, and in U.S. 
Patent Application Publication No. US 2010/0146635 Al, 
each of which is incorporated herein in its entirety by refer- 
ence. In particular, US 2010/0146635 Al expands on the 
teachings of apoptosis and applies them to autonomic self- 
sacrificing spacecraft. Taking inspiration from nature, 
whereby certain insects and other organisms (e.g., termites, 
bees) sacrifice some members of the hive or colony (e.g., 
worker ants, soldier termites) in order to protect the integrity 
of the hive, larvae, or the queen, the same self-sacrifice prop- 
erties are built-into autonomic self-sacrificing spacecraft. 

In an example, a swarm of autonomic spacecraft are pro- 
vided and certain space of the swann can be sacrificed in 
order to save other components in the swarm. Sacrifice can be 
made, for example, by one spacecraft using its solar sails to 
deflect debris during a solar stonn, even though such sacrifice 
may result in the device being damaged and no longer useable 
or viable. The sacrificing spacecraft may, however, be left 
with key instruments, assets, or power provisions that can be 
used by other members of the swann or system. In some 
cases, the self-sacrifice can result in other craft within the 
swann, being saved. Similarly, in a coordinated flight of a 
plurality of unmanned aerial vehicles (UAVs), some of the 
UAVs may be used to deflect damage to a key device carried 
by another UAV of the plurality. For example, a self-sacrifice 
operation can be earned out to protect a particular UAV of the 
plurality, for example, a UAV carrying a particular piece of 
equipment or other resource, even if the operation is likely to 
result in the destruction of the device providing the protec- 
tion. In effect, a component of the system can put itself in 
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harm’s way in order to ensure the greater good of the overall 
system. In some cases, a component of the system may turn 
itself off to avoid consuming resources that the system may 
otherwise use. 

According to various embodiments of the present teach- 
ings, a vehicle, craft, device, or other component of an auto- 
nomic system can be configured to donate its power provision 
or power source to ensure the continued operation of a dif- 
ferent component of the system. The donating component 
need not be specialized but rather can be a non-specialized 
component in the system that may be deemed less important 
than the component receiving the donated power provision. 
The power provision can comprise a battery, fuel, a fuel cell, 
a rocket, a rocket booster, a solar panel, a solar sail, a catalyst, 
a reactant, a reactor, an engine, a motor, a thruster, a drive, a 
magnet, a combination thereof, or the like. 

The donating component can be considered less important 
and appropriate for donating its power provisions, based on 
any of a number of criteria, taken alone or in combination. For 
example, the donating component can be considered less 
important and/or expendable because it is damaged, because 
it does not carry a necessary data collection device, because it 
does not carry a necessary scientific instrument, because it 
does not carry a necessary optical component, because it is 
one of a large number of duplicate components, because a 
mission objective has changed rendering the component use- 
less, because the component receiving the donated power 
provision is of extremely high importance, because the com- 
ponent receiving the donated power provision is a one-of-a- 
kind component, because of a combination of these reasons, 
or the like. 

In the context of swarms of spacecraft, swanns of under- 
water craft, or UAVs, the donating component, the receiving 
component, or both, can be able to rendezvous, dock, and/or 
tether with the other component and can be configured to 
transfer the power provision or connect their power provi- 
sions together. In an example, fuel sources can be joined 
together such that fuel can be transferred from the donating 
component to the receiving component, or batteries can be 
connected together such that charge can be transferred from 
the battery of the donating component to the battery of the 
receiving component. In some cases, fuel can be transferred 
from a fuel tank of the donating component directly to the 
engine of the receiving component, such that the fuel does not 
have to be transferred to and stored in a fuel tank of the 
receiving component. Similarly, in some cases, battery 
charge can be transferred from a battery of the donating 
component directly to the receiving component, such that the 
battery does not have to be transferred to and stored by the 
receiving component and/or such that the battery of the 
receiving does not receive charge from the battery of the 
donating component. In some cases, the donating component 
can attach one or more of its batteries to an unused connector 
or terminal set on the receiving component. 

According to various embodiments, the donating compo- 
nent can stay docked or tethered to the receiving component 
or can disconnect from the receiving component while leav- 
ing its power provision connected to the receiving compo- 
nent. In some cases, the various components of the autonomic 
system each be provided with one or more empty power 
provision slots for the purpose of receiving a donated power 
provision from a self-sacrificing sacrificing component of the 
system. For example, each can be provided with an empty 
battery slot or with an empty fuel cell slot and all the compo- 
nents can use the same type of batteries or fuel cells enabling 
donation from one component of the system to another. In 
some cases, the donating component, the receiving compo- 


8 

nent, or both, can be provided with a robotic arm, servo-motor 
system, vacuum system, docking system, or the like, for the 
purpose of enabling rendezvous of the components, transfer 
of the power provision, or hook-up to the donated power 
5 provision. 

According to various embodiments of the present teach- 
ings, an autonomic system is provided that comprises a plu- 
rality of autonomic components, for example, a coordinating 
autonomic component and a plurality of autonomic worker 
to components. Each of the autonomic components can be pro- 
grammed to (i) generate signals indicative of one or more 
triggering events, (ii) send the signals to the coordinating 
autonomic component, and (iii) decide to undergo a self- 
sacrifice procedure based on the occurrence of at least one of 
15 the one or more triggering conditions. The coordinating auto- 
nomic component can be programmed to assign programmed 
tasks and issue instructions to each of the plurality of auto- 
nomic worker components. Each of the autonomic worker 
components can comprise one or more resources. Following 
20 at least one or more of the triggering conditions, at least one 
of the autonomic components can donate one or more of its 
resources to one of the other autonomic components. The 
triggering event can comprise one or more of: an incorrect 
operation; a determination of likelihood of jeopardizing a 
25 primary objective of a mission; a failure to perfomi a self- 
configuration operation; a failure to perform a self-healing 
operation; a failure to perform a self-optimizing operation; a 
failure to perform a self-protecting operation; and a need to 
provide a resource to a more important autonomic component 
30 of the system. 

In some embodiments, one or more of the autonomic com- 
ponents can be configured to self-sacrifice by self-destruc- 
tion. At least one of the autonomic components can be con- 
figured to self-sacrifice by donating a power provision to 
35 another one of the autonomic components. The one or more 
resources can comprise one or more power provisions, for 
example, at least one of a fuel cell, a fuel, a rocket, a rocket 
booster, a solar panel, a solar sail, a catalyst, a reactant, a 
reactor, an engine, a motor, a thruster, a drive, a magnet, a 
40 combination thereof, or the like. In some cases, at least one of 
the autonomic components comprises a magnetometer, at 
least one of the autonomic components comprises an X-ray 
analyzer, and at least one of the autonomic components com- 
prises an infrared analyzer. 

45 According to various embodiments of the present teach- 
ings, a method is provided for managing an autonomic system 
comprising a plurality of autonomic components. The 
method can comprise generating a signal indicative of a trig- 
gering condition pertaining to at least one of the autonomic 
50 components of the plurality of autonomic components, and 
causing the at least one autonomic component to decide to 
undergo a voluntary self-sacrifice procedure based on the 
occurrence of the triggering condition. The voluntary self- 
sacrifice procedure can comprise determining whether any 
55 resources are available that could be donated to another auto- 
nomic component, donating the available resources to the 
other autonomic component, and then quiescing or self-de- 
structing. In some cases, the voluntary self-sacrifice opera- 
tion comprises donating a power provision to another auto- 
60 nomic component. In some cases, the voluntary self-sacrifice 
operation can comprise determining whether any resource, 
available for donation, is compatible with the other auto- 
nomic component, or whether a resource could be stored, 
transported, or both, by the second component, even if it is not 
65 compatible with the second component. 

According to yet other embodiments, the method can 
involve a voluntary self-sacrifice operation that comprises 
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determining whether it is safe to self-destruct here and now, 
and if it is not safe to self-destruct here and now, the method 
can comprise moving to a safe location for self-destruction, 
and self-destructing at the safe location. Hie voluntary self- 
sacrifice procedure can also comprise tethering or docking to 5 
another autonomic component and connecting a power pro- 
vision to the other autonomic component, for example, by 
plugging in an electrical cable, by removing a battery and 
inserting it into a battery slot of a receiving component, or the 
like. Voluntary self-sacrifice can be as simple as a component to 
turning itself off, either temporarily or permanently. 

In some embodiments, the method comprises invoking a 
voluntary self-sacrifice based on one or more of the following 
triggering conditions: an incorrect operation; a determination 
of likelihood of j eopardizing a primary obj ective; a failure to 1 5 
perform a self-configuration operation; a failure to perform a 
self-healing operation; a failure to perform a self-optimizing 
operation; a failure to perform a self-protecting operation; 
and a need to provide a resource to a more important auto- 
nomic component of the system. Even if a component is 20 
working fine, it may be more important to a mission for the 
component to self-sacrifice, for example, if needed to provide 
a resource to a more important autonomic component of the 
system. 

According to various embodiments of the present teach- 25 
ings, an autonomic system is provided that comprises a plu- 
rality of autonomic components, comprising a more impor- 
tant autonomic component and a plurality of less important 
autonomic components. The more important autonomic com- 
ponent can be programmed to (i) generate a need-for- resource 30 
signal indicative of a need for one or more resources, aid (ii) 
send the need-for-resource signal to one or more of the less 
important autonomic components. The less important auto- 
nomic components can be programmed to decide to undergo 
a self-sacrifice procedure based on receipt of the need-for- 35 
resource signal from the more important autonomic compo- 
nent. The self-sacrifice procedure can comprise donating one 
or more resources to the more important autonomic compo- 
nent. The self-sacrifice procedure can further comprise self- 
destructing after donating one or more resources to the more 40 
important autonomic component. The one or more resources 
can comprise one or more power provisions. The autonomic 
components can comprise one or ore space exploration 
vehicles, one or more deep sea exploration vehicles, or the 
like. 45 

In yet other embodiments of the present teachings, a 
method is provided for managing an autonomic system com- 
prising a plurality of autonomic components. The method can 
comprise generating a signal indicative of a need for a 
resource pertaining to a more important autonomic compo- 50 
nent of a plurality of autonomic components, and causing at 
least one less important autonomic component to decide to 
undergo a voluntary self-sacrifice procedure based on receiv- 
ing the signal indicative of a need for a resource. The volun- 
tary self-sacrifice procedure can comprise determining 55 
whether a needed resource is available that could be donated 
to the more important autonomic component, and donating 
the needed resource to the more important autonomic com- 
ponent. The voluntary self-sacrifice operation can comprise 
donating a power provision to the more important autonomic 60 
component. The voluntary self-sacrifice operation can com- 
prise determining whether the resource, available for dona- 
tion, is compatible with the more important autonomic com- 
ponent. The voluntary self-sacrifice operation can comprise 
determining whether it is safe to self-destruct here and now, 65 
and if it is not safe to self-destruct here and now, moving to a 
safe location for self-destruction, and self-destructing at the 
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safe location. The voluntary self-sacrifice procedure can 
comprise tethering or docking to the more important auto- 
nomic component and connecting or transferring power pro- 
vision to the more important autonomic component. 

According to various embodiments, a number of initiatives 
inspired by concepts from biology have arisen for self-man- 
agement of a complex system. Biological systems, and in 
particular, the Autonomic Nervous System (ANS), are 
capable of performing autonomic, innate or in-built, self- 
regulation activities requiring no conscious thought. In simi- 
lar fashion, and according to various embodiments of the 
present teachings, a software system is provided that manages 
itself. In some embodiments, the system takes advantage of 
emergent behavior similar to that in social insect colonies. It 
has been found that emergent behavior helps an insect colony 
to collectively solve complex problems without centralized 
control. Thus, colony (or swarm) behavior appears out of 
local interactions between individuals with simple rule sets 
and no global knowledge. In fact, emergent behavior does not 
“help” insect colonies in the general sense of the word, but 
instead it is the coordinated behavior of the social insects that 
collectively solves problems. What is emergent in this 
example is coherence and cooperation from a global point of 
view, where at the level of the individual nothing actively 
pushes for it. 

According to various embodiments of the present teach- 
ings, the self-sacrifice behavior of one or more individual 
components can be absorbed in serving the usefulness or lives 
of other individual components. Thus, an emergent behavior 
is provided wherein the individual components sacrifice 
themselves to jointly solve a complex problem vital to the 
entire system or swarm. In some embodiments, an emergent 
behavior can be provided by the system whereby one or more 
components of the system self-sacrifices itself for the greater 
good of the system. In an example, each component can be 
programmed to identify at least one condition which would 
cause the respective component to be detrimental to the 
greater good of the system. The component could also be 
programmed to self-sacrifice itself if the condition is deter- 
mined to exist, thereby benefit the entire system. As an illus- 
tration, such a time-to-self-sacrifice condition can comprise 
crossing a risk threshold determined by a risk analysis pro- 
gram. For example, if the continued operation of the compo- 
nent poses a risk of collision with another component of the 
system, and the risk exceeds a risk threshold, a self-sacrifice 
operation can be initiated for the greater good of the entire 
system. 

In some cases, the method can comprise causing each of 
the one or more faulty autonomic components to undertake a 
voluntary self-sacrifice operation comprising at least one of a 
transformation operation and a self-destruction operation. In 
some embodiments, the self-sacrifice can entail transforming 
to a shield unit, transforming to a messenger autonomic com- 
ponent, transforming to a coordinating autonomic compo- 
nent, or shutting down or turning off a scientific instrument. 
The one or more faulty autonomic components can comprise 
a plurality of faulty autonomic components or just a single 
faulty autonomic component. Self-sacrifice can also involve 
donating a resource or asset to another component of the 
system, even if the donating component is working perfectly 
fine, but wherein the donation would enable the receiving 
component to carry out a more important task or mission for 
the benefit of the greater system. 

According to various embodiments of the present teach- 
ings, an autonomic system is provided that comprises a plu- 
rality of autonomic components, for example, a coordinating 
autonomic component, a messenger autonomic component, 
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and a plurality of autonomic worker components. Each auto- 
nomic component of the plurality of autonomic components 
can be individually programmed to (i) generate signals 
indicative of one or more triggering events, (ii) send the 
signals to one or more of the other autonomic components, 5 
and (iii) self-sacrifice voluntarily based on the occurrence of 
a triggering event. In an exemplary embodiment, the plurality 
of autonomic components can comprise a coordinating auto- 
nomic component that is programmed to assign programmed 
tasks and issue instructions to each of a plurality of autonomic to 
worker components. In some embodiments, the system can 
comprise a messenger autonomic component that is config- 
ured to facilitate communication between a coordinating 
autonomic component and one or more autonomic worker 
components. Each of the autonomic worker components can 15 
comprise one or more scientific instruments and can be con- 
figured to operate the respective one or more scientific instru- 
ments. At least one of the autonomic components of the 
system can be configured to self-sacrifice voluntarily by 
transformation or self-destruction upon occurrence of a trig- 20 
gering event. 

In some embodiments, the triggering event that can lead to 
self-sacrifice can comprise one or more of: an incorrect opera- 
tion; a determination of likelihood of jeopardizing a primary 
objective; a failure to perform a self-configuration operation; 25 
a failure to perform a self-healing operation; a failure to 
perform a self-optimizing operation; a failure to perform a 
self-protecting operation, and the like. The self-sacrifice can 
comprise a transformation operation, for example, a transfor- 
mation of an autonomic component to a shield unit. In some 30 
embodiments, self-sacrifice can comprise a transformation to 
a different type of autonomic component, for example, from 
an autonomic worker component to a messenger autonomic 
component, or a transformation from an autonomic worker 
component to a coordinating autonomic component. Self- 35 
sacrifice can occur by other means as well, for example, 
self-sacrifice can comprise shutting down or turning off a 
scientific instrument. 

In some embodiments, the autonomic system can comprise 
one or more deep sea exploration vehicles or space explora- 40 
tion vehicles, for example, a plurality of different vehicles. 
Each vehicle can have one or more scientific instruments 
on-board and redundancies can be built into the system such 
that two or more of the vehicles can have the same type of 
instrument on-board. For example, at least one of the auto- 45 
nomic components can comprise a magnetometer, at least one 
of the autonomic worker components can comprise an X-ray 
analyzer, and at least one of the autonomic worker compo- 
nents can comprise an infrared analyzer. 

According to various embodiments of the present teach- 50 
ings, an autonomic nano technology swarm (ANTS) system 
is provided. With the ANTS system, a swann of small autono- 
mous exploration vehicles, such as spacecraft, can be used for 
an exploration mission, thus reducing the costs and risks 
involved when only a single, larger spacecraft is used. The 55 
system further enables exploration missions where a single, 
large, spacecraft would be impractical, and can offer greater 
redundancy and increased mission longevity in harsh envi- 
ronments. The ANTS system can exhibit all of the features of 
a multi-agent autonomic system (AS) wherein the spacecraft, 60 
vehicles, or system components themselves are autonomic 
elements (AEs). 

According to various embodiments, the software architec- 
ture is adaptive in all its attributes and functionality, including 
its performance, security, fault tolerance, configurability, and 65 
the like. Moreover, the system can make decisions to cope 
with new environmental conditions encountered, and can 
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learn and evolve to become better adapted to what it is sup- 
posed to do. Thus, a spacecraft unit can be programmed such 
that its own self-sacrifice can be used to protect other com- 
ponents or units vital to the system, or programmed to self- 
sacrifice if the result would be a significant performance gain 
for the entire system or mission. 

In some embodiments, the emergent behavior is a complex 
behavior derived spontaneously from simple rules. Thus, the 
emergent behavior can enable the production of a high-level, 
more complex behavior through the interaction of multiple 
system components, by following simple rules. 

The self-sacrifice behavior described herein differs from 
the other approaches mentioned above in at least the follow- 
ing ways . F irstly, in some embodiments, “death” is not always 
assumed for the individual component. Secondly, in some 
embodiments, self-sacrifice can comprise making a choice of 
leaving a critical task to another individual component when 
the individual’s own performance is not optimal. These and 
other advantages are apparent from the present teachings. 

According to various embodiments, an autonomic element 
in a system comprising numerous autonomic elements can 
exhibit or be programmed to exhibit self-adapting behavior to 
improve performance and/or to protect vital parts of the sys- 
tem. According to some embodiments, an autonomic element 
can comprise a spacecraft in an autonomous space mission. 
According to some embodiments, the spacecraft can com- 
prise an autonomous worker vehicle or component in an 
autonomous space mission which mission involves using a 
plurality of different spacecrafts. According to some embodi- 
ments, the autonomic space mission can be performed by an 
ANTS system as described above. According to some 
embodiments, each spacecraft in the ANTS system can have 
a specialized mission. According to some embodiments, indi- 
vidual components, such as spacecraft or units in the ANTS 
system, can be programmed to exhibit emergent self-adapting 
behavior. An individual spacecraft unit of the system can 
perform self-sacrifice as part of its self-adapting behavior, in 
order to improve the system performance and/or to protect 
vital parts of the system, for example, based on goals of an 
exploration mission. 

According to various embodiments, the system uses Auto- 
nomic System Specification Language (ASSL). The ASSL 
can be used to model the self-sacrifice behavior of the indi- 
vidual spacecraft units. The ASSL can follow simple pre- 
defined rules, but can help in the formation of an emergent 
complex system-level behavior that strives to protect and 
optimize the system as a whole. It should be understood that 
by self-sacrifice, “death” is not the only option under consid- 
eration for the spacecraft, but rather, in some embodiments 
another option for self-sacrifice can comprise a voluntary 
relinquishment from the “social status” of the spacecraft in 
the swarm. According to some embodiments, the voluntary 
relinquishment from the “social status” can be achieved by 
delegating rights from one component to another, for 
example, from one spacecraft to another spacecraft of the 
system. 

The systems, clients, servers, methods, computer-readable 
media, software, hardware, and operating environments that 
can be used include those described in U.S. Patent Applica- 
tions Publications Nos. US 2007/0073631 Al, entitled “Sys- 
tems, Methods and Apparatus for Quiescence of Autonomic 
Systems,” and US 2007/0260570 Al, entitled “Systems, 
Methods and Apparatus for Autonomic Safety Devices,” 
which are incorporated herein in their entireties, by reference. 
ANTS Structure 

According to various embodiments of the present teach- 
ings, an ANTS system is provided for use in a sub-mission 
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Prospecting Asteroids Mission (PAM). The PAM can provide 
a novel approach to asteroid belt resource exploration. ANTS 
can provide extremely high autonomy, m inim al communica- 
tion requirements to Earth, and a set of very small explorers 
with few consumables. In some embodiments, the explorers 
forming the swarm can be pico-class, low-power, and low- 
weight spacecraft units, yet capable of operating as fully 
autonomous and adaptable agents. 

FIG. 1 depicts a PAM sub-mission scenario of the ANTS 
concept mission, according to various embodiments of the 
present teachings. As depicted in FIG. 1, a transport space- 
craft launched from Earth toward an asteroid belt can carry a 
laboratory that assembles tiny spacecraft. Once the transport 
spacecraft reaches a certain point in space where gravitational 
forces are balanced, termed a Lagrangian, and in this case the 
LI Lagrangian point, the transport ship can release the 
assembled swarm, which can head toward the asteroid belt. 
Each spacecraft can be equipped with a solar sail and thereby 
can rely primarily on power from the sun, using, for example, 
tiny thrusters to navigate independently. 

As FIG. 1 shows, there can be at least three classes of 
spacecraft: coordinating autonomic components (rulers); 
messenger autonomic components (messengers); and auto- 
nomic worker components (workers). By grouping them in 
appropriate ways, the ANTS system can form teams that 
explore particular asteroids of the asteroid belt. Hence, the 
ANTS system can exhibit self-organization since there is no 
external force directing its behavior and no single spacecraft 
having a global view of the intended macroscopic behavior. 
According to some embodiments, the internal organization of 
the swarm can depend on the global task to be performed and 
on the current environmental conditions. According to some 
embodiments, the swarm can consist of several sub-swarms, 
which can be temporal groups organized to perform a par- 
ticular task. According to some embodiments, each sub- 
swarm can have a coordinating group leader (ruler), one or 
more messengers, and a number of workers each carrying at 
least one specialized instrument. According to some embodi- 
ments, the messengers can connect or provide communica- 
tions between the team members when such team members 
cannot connect directly to one another. 

Self-Sacrifice Scenarios in ANTS 

According to various embodiments, the system can imple- 
ment self-optimization. In general, the global system optimi- 
zation can be correlated to the optimization of the individual 
system elements. Each component of the system can improve 
its performance on-the-fly. For example, in some embodi- 
ments rulers can use experience gained to self-optimize. As 
an example, rulers can use their experience to improve their 
ability to identify asteroids. In some embodiments, messen- 
gers can strive to find the best position to improve communi- 
cation among the other components or swarm units. Accord- 
ing to some embodiments, workers can self-optimize through 
learning and experience. 

Single components can “die” for the good of the entire 
system or otherwise self-sacrifice, for example, by voluntar- 
ily relinquishing their posts. In some embodiments, a space- 
craft unit can, for example, voluntarily relinquish its post as 
an ANTS worker component by delegating tasks to other 
worker components. While scenarios related to self-sacrifice 
of ANTS workers are described in great detail herein, it is to 
be understood that other classes of spacecraft, for example, 
rulers and/or messengers, can also be configured to self- 
sacrifice voluntarily. 

According to various embodiments, a worker can “die” or 
sacrifice itself voluntarily. For example, a worker can sacri- 
fice itself voluntarily when the worker cannot continue per- 
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forming its duties as a worker. As an illustration, a worker can 
self-sacrifice if it cannot continue to support the service-level 
objectives assigned to it (for example, if it cannot achieve 
performance). While operating in space, for example, an 
5 instrument of a worker can be damaged but not destroyed. For 
example, the instrument may still be operational, but its per- 
formance mi gilt be degraded or destroyed. According to some 
embodiments, a worker with a destroyed or heavily damaged 
instrument that performs below a performance minimum, can 
to self-sacrifice voluntarily. 

According to some embodiments, the self-sacrifice can 
comprise a transformation, for example, a transformation of a 
worker. If a worker cannot perform its duties anymore, due to 
a damage or instrument loss, the worker can, according to 
15 various embodiments, perform one or more operations. The 
operations can comprise, for example, asking the ruler to 
assign a new replacement worker, and/or striving to transform 
into another category of component useful to the swarm unit. 
Such transformation can comprise, for example, transform- 
20 ing from a worker to a messenger, from a messenger to a 
worker, from a worker to a ruler, or the like. According to 
some embodiments, a worker can try to transform to a ruler or 
a messenger, but if it is not possible for the worker to trans- 
form to a ruler or messenger, the worker can instead transform 
25 to a shield component such as a stand-by shield. According to 
some embodiments, such a shield component can sail nearby 
and strive to protect the replacement worker from different 
hazards. For example, a shield unit can, according to some 
embodiments, take the impact of an incoming small asteroid 
30 which is about to hit the replacement worker. The shield unit 
does not have to spend additional time and resources to 
recover from thi s probable impact. Thi s kind of protection can 
comprise a complete self-sacrifice because the shield unit can 
serve as such until its full destruction, while increasing the 
35 overall performance of the system. 

According to various embodiments, the self-sacrifice 
operation can comprise a self-destruction operation. Accord- 
ing to some embodiments, when a worker is damaged so 
badly that it cannot move anymore, the worker can self- 
40 destruct, for example, by exploding. This can be used to avoid 
the risk of collision with another component of the system. 
Hence, there can be a real self-sacrifice that indirectly leads to 
higher system performance, due to the reduction in the risk of 
an impact. 

45 According to various embodiments, the self-sacrifice 
behavior of a single component, such as a spacecraft unit in an 
ANTS system, can be modeled with Autonomic System 
Specification Language (ASSL). With ASSL, validation and 
code generation of the specified ASs canbe achieved. Accord- 
50 ing to various embodiments, the ASSL canbe defined through 
formalization tiers. According to some embodiments, over 
the formalization tiers, ASSL can provide a multi-tier speci- 
fication model that is designed to be scalable and to expose a 
judicious selection and configuration of infrastructure ele- 
55 ments and mechanisms needed by an AS. ASSL can define an 
AS with interaction protocols andAEs, where the ASSL tiers 
and their sub-tiers describe different aspects of the AS under 
consideration, like policies, communication interfaces, 
execution semantics, actions, and the like. 

60 According to various embodiments, the ASSL tiers and 
their sub-tiers, as shown in FIG. 2, can be abstractions of 
different aspects of the autonomic system under consider- 
ation. According to some embodiments, the AS Tier can 
specify an AS in terms of service-level objectives (AS SLO), 
65 self-management policies, architecture topology, actions, 
events, and metrics. According to some embodiments, the AS 
SLO can be a high-level form of behavioral specification that 
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establishes system objectives such as performance. Accord- 
ing to some embodiments, the self-management policies of an 
AS can include: 1) self-configuring; 2) self-healing; 3) self- 
optimizing; and 4) self-protecting (also referred to herein as a 
self-CHOP of an AS). Other self-management policies can 5 
also or instead be included. According to some embodiments, 
the metrics can constitute a set of parameters and observables 
controllable by the AEs. 

According to various embodiments, at the AS Interaction 
Protocol tier, the ASSL framework can specify an AS-level to 
interaction protocol (ASIP). According to some embodi- 
ments, ASIP can be a public communication interface, 
expressed as communication channels, communication func- 
tions, and messages. 

According to various embodiments, at the AE Tier, the 15 
ASSL formal model considers AEs to be analogous to soft- 
ware agents able to manage their own behavior and their 
relationships with other AEs. According to some embodi- 
ments, at the AE Tier, ASSL can describe the individual AEs. 

According to various embodiments, a worker’s self-sacri- 20 
lice behavior can be modeled with ASSL. It should be under- 
stood that the model presented and described herein is exem- 
plary only. 

According to various embodiments, the self-sacrifice 
behavior can comprise a self-management policy, which can 25 
be specified at the individual component or spacecraft level 
(at the AE Tier). FIG. 2 presents a partial specification of a 
self-sacrifice policy that can be used according to various 
embodiments based on the scenarios described herein. FIG. 2 
describes possible choices a worker can make when the 30 
worker is no longer minimally or fully operational. According 
to various embodiments, the definitions that follow can be 
used to specify exemplary the self-sacrifice policies. 

Self-sacrifice can be defined as a self-management policy 
structure. A set of fluents and mappings can be used to specify 35 
this policy. With fluents, specific situations can be expressed, 
in which the policy is interested. With mappings, the situa- 
tions can be mapped to actions. 

Actions can be defined as a set of actions that can be 
undertaken by the worker in response to certain conditions, 40 
and according to that policy, as shown in FIG. 3. 

Events can be defined as a set of events that initiate fluents 
and can optionally be prompted by actions according to that 
policy. 

Metrics can be defined as a set of metrics needed by that 45 
policy. 

According to various embodiments, the unableToExplore 
fluent, shown in FIG. 2, can take place when the worker is no 
longer operational, due to, for example, heavy damage or 
instrument loss. The fluent can be initiated by an instrlsNon- 50 
functional event and can terminate if one of the events can- 
BeRuler, canBeMessenger, canBeShield, or mustBeDes- 
troyed occurs. In some embodiments, this fluent can be 
mapped to a checkTransformation action that checks for a 
possible worker transformation and triggers one of the trig- 55 
gering events that terminate the current fluent. According to 
some embodiments, each of the terminating events can ini- 
tiate a new fluent respectively. According to some embodi- 
ments, the “transform” fluents, shown in FIG. 2, can be 
mapped to “transformTo” actions, exemplary portions of 60 
which are presented in FIG. 3 . The mapping can transform the 
worker into a ruler, a messenger, or a shield, according to the 
example shown. As specified, the transformation attempts can 
be hierarchically related. Thus, when possible, the transfor- 
mation process can start with a transformation into a ruler or 65 
into a messenger, and then, in case of failure, the algorithm 
can attempt to perform a transformation into a shield. Accord- 
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ing to some embodiments, at the end of the hierarchically 
ordered transformations, self-destruction of the worker can 
be performed, in case none of the transformations is success- 
fill. A self-destruction device can be included in or on the 
component, for example, an explosive charge and appropriate 
detonation circuitry mounted in a spacecraft. 

According to various embodiments, ASSL can allow speci- 
fication of systems evolving over time. According to some 
embodiments, the evolution of such systems can take place in 
the actions of the system. According to some embodiments, 
via a finite set of change, remove, add, and create statements, 
the actions of the system can prompt changes in the tiers and 
sub-tiers of the AS under consideration. 

FIG. 4 presents a partial specification of some of the 
actions which can be needed by the self-sacrifice policy. It 
should be understood that, the “transformTo” actions can 
change the service-level objectives (SLO) of the worker 
under consideration. According to some embodiments, these 
actions can be used to re-specify the component or unit in 
accordance with the new SLO. According to some embodi- 
ments, the transformToShield action can first remove the old 
worker SLO specifications and next create the new shield 
SLO, as shown in FIG. 3, thus avoiding contradictions 
between both worker and shield SLO. It should be understood 
that while the add statements in FIG. 3 are only partially their 
use in a more complex algorithm would be apparent to those 
skilled in the art given the present teachings. 

According to some embodiments, the transformToShield 
action can turn off the other worker’s self-management poli- 
cies to avoid contradictions between both worker and shield 
SLO. According to some embodiments, the transform- 
ToShield action can turn off the other worker’s self-manage- 
ment policies via four change statements, which set the 
SWITCH flag of the self-management policies to OFF. 

In some embodiments, the physical transformation can be 
accomplished by the IMPL routine doShieldTransformation. 
The IMPL clause states “for further implementation”. This 
means that the ASSL framework will generate doShield- 
Transformation as an empty routine for manual implementa- 
tion. 

Donation of Power Provision 

FIG. 5 is a flow chart showing various steps involved with 
an exemplary method of the present teachings, wherein a 
component of an autonomous system, which has received or 
generated a quiesce or self-sacrifice command, is evaluated to 
determine whether the component has resources that can be 
donated, or salvaged and donated, to one or more other com- 
ponents of the system. If there are such available resources, 
then other conditions can be taken into consideration and 
other actions may be taken before the quiesce or self-sacrifice 
function is carried out. The resources can be fuel, a fuel cell, 
a battery, battery power, a solarpanel, otherpowerprovisions, 
a scientific instrument, an optical component, a mechanical 
component, a reactor, a combination thereof, or the like. If 
one or more such resources are available, then the method can 
comprise generating a reprieve signal to delay the quiesce or 
self-sacrifice of the component. The method can comprise 
making a determination as to whether the one or more 
resources available are compatible with another component 
of the system, that is, a potential receiving component. The 
method can involve looking up data or comparing data to a 
look-up table, accessing a parts list stored in a memory device 
in or on the donating component, asking for and/or receiving 
information by electromagnetic transmission, or the like. If 
the one or more resources are compatible, then a determina- 
tion can be made as to whether the component is capable, for 
example, in close enough physical proximity, to rendezvous 
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with the receiving component. If so, the one or more 
resources can be transferred, moved, re-located, or the like, 
from the donating component to the receiving component. 
The donating component, the receiving component, or both, 
can be autonomous and both can be part of the same auto- 5 
nomic system. Time delay in making all the determinations 
and calculations, and time delay in carrying out the donation, 
can be considered and the risk associated with that time delay 
can be determinative of whether to pursue such a course of 
action. to 

If a donation is completed, the donating component can 
then determine whether there are one or more other salvage- 
able resources available. For example, the donating compo- 
nent may have had a rendezvous with a receiving component 
of the system and donated all resources compatible with the 15 
receiving component, for example, that might benefit the 
receiving component or that the receiving component might 
hold onto and eventually pass along to yet another component 
of the system. If, after the transfer of all compatible resources 
to the receiving component, the donating component still has 20 
other resources that might be compatible with yet other com- 
ponents of the system, then the method can involve maintain- 
ing or renewing the reprieve signal. Further calculations and/ 
or determinations can be made, depending on risk, as to 
whether the donating component may proceed to carry out 25 
one or more additional donations until all resources available 
for donation have been donated or are exhausted. If the risk of 
doing harm and the harm to the system are determined to 
outweigh to benefits that would be achieved by another dona- 
tion, then the method can involve proceeding to a quiesce or 30 
self-sacrifice procedure. 

In some cases, for example, a component can quiesce for 
long periods of time, even years, if quiescence would not 
harm the system. In some cases, the component can remain in 
quiescence whether or not resources to be donated are avail- 35 
able. If it is determined that it is safe to quiesce, the compo- 
nent can quiesce. If it is determined that it is not safe to 
quiesce, then the component can self-sacrifice or self-de- 
struct. 

As can be seen in FIG. 5, if it is determined that no sal- 40 
vageable resources are available, then the component having 
received the quiesce or self-sacrifice signal, proceeds to a 
quiesce or self-sacrifice procedure. The procedure can entail 
making a detennination as to whether it is safe to quiesce or 
self-sacrifice. As can further be seen in FIG. 5, if the one or 45 
more resources are not compatible with any other compo- 
nents of the system, the reprieve signal can be withdrawn and 
the component can proceed with quiescence or self-sacrifice. 
Self-sacrifice can involve self-destruction and self-destruc- 
tion can involve determining whether it is safe to self-destruct 50 
here and now. If it is not safe to self-destruct here and now, 
then the component can move to a safe location for self- 
destruction, and then self-destruct. 

FIG. 6 is a flow chart showing various steps involved with 
yet another exemplary embodiment of the present teachings, 55 
wherein a first spacecraft that has received or generated a 
self-destruct co mm and is evaluated to determine whether it 
has a power provision that can be donated to a second space- 
craft before self-destruction. If such a power provision is 
available, then the method can comprise generating a reprieve 60 
signal to delay the self-destruction of the component. The 
power provision can comprise a fuel, a fuel cell, a battery, 
battery power, a solar panel, a reactor, any other power pro- 
vision, a combination thereof, or the like. The method can 
comprise making a detennination as to whether the one or 65 
more resources available are compatible with another space- 
craft of the system, that is, a potential receiving spacecraft. 
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The method can involve looking up data or comparing data to 
a look-up table, accessing a parts list stored in a memory 
device in or on the donating component, asking for and/or 
receiving information by electromagnetic transmission, or 
the like. If the one or more power provisions are compatible, 
then a detennination can be made as to whether the donating 
spacecraft is capable of a rendezvous with the second space- 
craft, for example, in close enough physical proximity. If so, 
the one or more power provisions can be transferred, moved, 
re-located, or the like, from the donating spacecraft to the 
receiving spacecraft. The donating spacecraft, the receiving 
spacecraft, or both, can be autonomous and both canbepartof 
the same autonomic system. 

Time delay in making all the determinations and calcula- 
tions, and time delay in carrying out the donation, can be 
considered and the risk associated with that time delay can be 
determinative of whether o pursue such a course of action. If 
a donation is completed, the donating spacecraft can then 
determine whether there are one or more other salvageable 
power provisions available. For example, the donating space- 
craft may have had a rendezvous with a receiving spacecraft 
of the system and donated fuel cell power provisions compat- 
ible with the receiving spacecraft, but the salvageable batter- 
ies of the donating spacecraft might not be compatible with 
the receiving spacecraft. If, after the transfer of all compatible 
power provisions to the receiving spacecraft, the donating 
component still has other power provisions that might be 
compatible with yet another spacecraft of the system, then the 
method can involve maintaining or renewing the reprieve 
signal. Further calculations and/or determinations can be 
made, depending on risk, as to whether the donating space- 
craft may proceed to carry out one or more additional dona- 
tions until all power provisions available for donation have 
been donated or are exhausted, or until the risk of doing harm 
and the harm to the system are determined to outweigh to 
benefits that would be achieved if another donation were to 
occur. 

As can be seen in FIG. 6, if it is detemiined that no sal- 
vageable power provisions are available, then the spacecraft 
that received the self-destruct signal proceeds to a self-de- 
struct procedure. As can further be seen in FIG. 6, if the one 
or more power provisions are not compatible with any other 
spacecraft of the system, the reprieve signal can be withdrawn 
and the spacecraft can proceed with self-destruction. Self- 
destruction can involve determining whether it is safe to 
self-destruct here and now. If it is not safe to self-destruct here 
and now, then the component can move to a safe location for 
self-destruction, and then self-destruct. 

As exemplified in FIGS. 7 and 8, self-sacrifice can also 
involve donating a resource or asset to another component of 
the system, even if the donating component is working per- 
fectly fine, but wherein the donation would enable the receiv- 
ing component to carry out a more important task or mission 
for the benefit of the greater system. FIG. 7 is a flow chart 
showing various steps involved with such a method, wherein 
a more important component of an autonomous system has 
received or generated a need for resource signal, and a less 
important component is evaluated to determine whether the 
less important component can be self-sacrificed to donate a 
needed resource to the more important component of the 
system. For example, a more important component of an 
autonomous system, such as a more important spacecraft, can 
receive or generate a need for resource signal. The resource 
needed can include, but need not be limited to, a power 
provision. A less important component of the system, such as 
a less important spacecraft, can then be contacted or interro- 
gated to determine if it has a corresponding resource avail- 
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able. If not, the more important component of the system can 
continue to search for the needed resource, for example, by 
contacting or interrogating other less important components 
of the system. 

As shown in FIG. 7, if a less important component of the 
system does have the needed resource available, then the 
method can involve self-sacrificing the less important com- 
ponent, at least to the extent that it donates the needed 
resource, so that the more important component can receive 
the needed resource. If the less important component is to be 
self-sacrificed, the method can determine if there are other 
resources that can also be donated along with the needed 
resource. If other resources are available to be donated by the 
less important component, the method can involve weighing 
the benefits and detriments of the more important component 
taking on the additional, not needed, resources. If the less 
important, self-sacrificing component has no resources avail- 
able for donation besides the needed resource, then the less 
important component may permanently shut down, jettison 
off into space, or self-destruct, for example, by activating an 
explosive charge or by steering itself or being pushed into a 
planet, sun, moon, asteroid, or other body. 

In some cases, the method can involve determining 
whether the resource available from a less important compo- 
nent is compatible with the more important component. In 
some cases, the method can involve determining whether the 
less important component and the more important component 
are capable of a rendezvous, for example, whether they have 
compatible docking connections, whether they are in close 
enough proximity, or whether the risk involved with a ren- 
dezvous is too great to be worthwhile. In some cases, the 
docking compatibility, resource compatibility, or both, can be 
determined before the method proceeds to determine whether 
the less important component has the needed resource, 
because if the two components are not capable of a rendez- 
vous with one another, then it may be immaterial whether the 
less important component has the needed resource. 

FIG. 8 is a flow chart showing various steps involved with 
another exemplary method of the present teachings, wherein 
a more important spacecraft of an autonomous system gen- 
erates a need for a power provision signal, and a less impor- 
tant spacecraft of the autonomous system is evaluated to 
determine whether it can be self-sacrificed to donate a power 
provision and fill the need of the more important a spacecraft. 
Similar to the method depicted in FIG. 7, the method depicted 
in FIG. 8 involve donating a resource or asset to another 
component of the system, her, a power provision, even if the 
donating spacecraft is working perfectly fine. The result is 
that the donation enables the receiving, more important 
spacecraft, to carry out a more important task or mission for 
the benefit of the greater autonomous system, even at the cost 
of losing a perfectly good, but less important, spacecraft. The 
method can involve contacting or interrogating a less impor- 
tant spacecraft to determine if it has a power provisions avail- 
able. If not, the more important spacecraft can continue to 
search for the needed power provision, for example, by con- 
tacting or interrogating other less important spacecraft of the 
autonomous system. 

As shown in FIG. 8, if a less important spacecraft does have 
the needed power provision, then the method can involve 
self-sacrificing the less important spacecraft, at least to the 
extent that it donates the needed power provision, so that the 
more important component can receive the needed power 
provision. If the less important spacecraft is to be self-sacri- 
ficed, the method can also determine whether there are any 
other resources that can also be donated along with the needed 
power provision. If other resources are available to be 
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donated by the less important spacecraft, the method can 
involve weighing the benefits and detriments of having the 
more important spacecraft take on the additional, not needed, 
resources. In some cases, other resources may need to be 
5 tested to determine whether they in good working order, 
damaged, or not responding. If the less important, self-sacri- 
ficing spacecraft has no other resources available for donation 
besides the needed power provision, then the less important 
component may permanently shut down, jettison off into 
to space, or self-destruct, for example, by activating an explo- 
sive charge or by steering itself or being pushed into a planet, 
sun, moon, asteroid, or other body. 

In some cases, the method can involve determining 
whether the power provision available from a less important 
15 spacecraft is compatible with the more important spacecraft. 
In some cases, the method can involve determining whether 
the less important spacecraft and the more important space- 
craft are capable of a rendezvous, for example, whether they 
have compatible docking connections, whether they are in 
20 close enough proximity to one another, or whether the risk 
involved with a rendezvous is too great to be worthwhile. In 
some cases, the docking compatibility, resource compatibil- 
ity, or both, can be determined before the method proceeds to 
determine whether the less important component lias the 
25 needed power provision, because if the two components are 
not capable of a rendezvous with one another, then it may be 
immaterial whether the less important component has the 
needed resource. 

While spacecraft have been exemplified herein as the sys- 
30 tern components, it is to be understood that other systems and 
components are also within the scope and spirit of the present 
teachings. The multi-agent autonomic system described 
herein can comprise a swarm of spacecraft, a plurality of 
unmanned vehicles, a plurality of unmanned aerial vehicles, a 
35 multi-component communications system, a swarm of under- 
water crafts, a swarm of unmanned underwater crafts, a plu- 
rality of robots, a constellation of satellites, or the like, and all 
of these systems should be considered to be within the realm 
of the present teachings. 

40 Other embodiments of the present invention will be appar- 
ent to those skilled in the art from consideration of the present 
specification and practice of the present invention disclosed 
herein. It is intended that the present specification and 
examples be considered as exemplary only with the true 
45 scope and spirit of the invention being indicated by the fol- 
lowing claims and equivalents thereof. 

What is claimed is: 

1. .An autonomic system, the autonomic system compris- 
ing: 

50 a plurality of autonomic components, the plurality of auto- 
nomic components comprising a coordinating auto- 
nomic component and a plurality of autonomic worker 
components, each autonomic component of the plurality 
of autonomic components being programmed to (i) gen- 
55 erate signals indicative of one or more triggering events, 

(ii) send the signals to the coordinating autonomic com- 
ponent, and (iii) decide to undergo a self-sacrifice pro- 
cedure based on the occurrence of at least one of the one 
or more triggering conditions, 

60 wherein the coordinating autonomic component is pro- 
grammed to assign programmed tasks and issue instruc- 
tions to each of the plurality of autonomic worker com- 
ponents, each of the autonomic worker components 
comprises one or more resources, and, following at least 
65 one or more triggering conditions, at least one of the 
autonomic components of the plurality of autonomic 
components donates one or more of its resources to one 
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of the other autonomic components of the plurality of 
autonomic components, wherein the one or more trig- 
gering events comprises one or more of: 
an incorrect operation; 

a determination of likelihood of jeopardizing a primary 5 
objective; 

a failure to perform a self-configuration operation; 
a failure to perform a self-healing operation; 
a failure to perform a self-optimizing operation; 
a failure to perform a self-protecting operation; 1 

a failure to perform another self-operation; and 
a need to provide a resource to a more important autonomic 
component of the system, wherein an autonomic com- 
ponent is more important for being at least one of a 15 
necessary data collection device, a carrier of a scientific 
instrument, a carrier of an optical component, a unique 
component, or the like. 

2. The autonomic system of claim 1, wherein at least one of 
the autonomic worker components is configured to self-sac- 20 
rifice by self-destruction. 

3. The autonomic system of claim 1, wherein the one or 
more resources comprises one or more power provisions. 

4. The system of claim 3, wherein the one or more power 
provisions comprises at least one of a fuel cell, a fuel, a rocket, 25 
a rocket booster, a solar panel, a solar sail, a catalyst, a 
reactant, a reactor, an engine, a motor, a thruster, a drive, a 
magnet, and a combination thereof. 

5. The system of claim 1, wherein at least one of the 
plurality of autonomic worker components is configured to 30 
self-sacrifice by donating a power provision to another one of 
the autonomic components. 

6. The autonomic system of claim 1, wherein the plurality 

of autonomic components comprises one or more space 
exploration vehicles, 35 

7. The autonomic system of claim 1, wherein the plurality 
of autonomic components comprises one or more deep sea 
exploration vehicles. 

8 . The autonomic system of claim 1, wherein at least one of 
the autonomic components comprises a magnetometer, at 40 
least one of the autonomic components comprises an X-ray 
analyzer, and at least one of the autonomic components com- 
prises an infrared analyzer. 

9. A method for managing an autonomic system compris- 
ing a plurality of autonomic components, the method com- 45 
prising: 

generating a signal indicative of a triggering condition 
pertaining to at least one of the autonomic components 
of the plurality of autonomic components; and causing 
the at least one autonomic component to decide to 50 
undergo a voluntary self-sacrifice procedure based on 
the occurrence of the triggering condition, wherein the 
voluntary self-sacrifice procedure comprises determin- 
ing whether any resources are available that could be 
donated to another autonomic component of the plural- 55 
ity, donating the available resources to the other auto- 
nomic component, and then quiescing or self-destruct- 
ing, wherein the triggering condition comprises one or 
more of: 

an incorrect operation; 60 

a determination of likelihood of jeopardizing a primary 
objective; 

a failure to perform a self-configuration operation; 
a failure to perform a self-healing operation; 
a failure to perform a self-optimizing operation; 65 

a failure to perform a self-protecting operation; 
a failure to perform another self-operation; and 
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a need to provide a resource to a more important autonomic 
component of the system, wherein an autonomic com- 
ponent is more important for being at least one of a 
necessary data collection device, a carrier of a scientific 
instrument, a carrier of an optical component, a unique 
component, or the like. 

10. The method of claim 9, wherein the voluntary self- 
sacrifice operation comprises donating a power provision to 
the other autonomic component. 

11. The method of claim 9, wherein the power provision 
comprises one or more of a fuel cell, a fuel, a rocket, a rocket 
booster, a solar panel, a solar sail, a catalyst, a reactant, a 
reactor, an engine, a motor, a thruster, a drive, a magnet, and 
a combination thereof. 

12. The method of claim 9, wherein the voluntary self- 
sacrifice operation comprises determining whether any 
resource, available for donation, is compatible with the other 
autonomic component. 

13. The method of claim 9, wherein the voluntary self- 
sacrifice operation comprises determining whether it is safe 
to self-destruct immediately at present location. 

14. The method of claim 9, wherein the voluntary self- 
sacrifice procedure compri ses determining that it is not safe to 
self-destruct immediately at present location, moving to a 
safe location for self-destruction, and self-destructing at the 
safe location. 

15. Hie method of claim 9, wherein the voluntary self- 
sacrifice procedure comprises tethering or docking to another 
autonomic component of the plurality and connecting a 
power provision to the other autonomic component. 

16. The method of claim 9, wherein at least one autonomic 
component of the plurality of autonomic components com- 
prises a space exploration vehicle. 

17. The method of claim 9, wherein at least one of the 
autonomic components comprises a deep sea exploration 
vehicle. 

18. The method of claim 9, wherein at least one of the 
autonomic components comprises a magnetometer, at least 
one of the autonomic components comprises an X-ray ana- 
lyzer, and at least one of the autonomic components com- 
prises an infrared analyzer. 

19. An autonomic system, the autonomic system compris- 
ing: 

a plurality of autonomic components, the plurality of auto- 
nomic components comprising a more important auto- 
nomic component and a plurality of less important auto- 
nomic components, the more important autonomic 
component being programmed to (i) generate a need- 
for-resource signal indicative of a need for one or more 
resources, and (ii) send the need-for-resource signal to 
one or more of the less important autonomic compo- 
nents, the less important autonomic components being 
programmed to decide to undergo a self-sacrifice proce- 
dure based on receipt of the need-for-resource signal 
from the more important autonomic component, 

wherein the self-sacrifice procedure comprises donating 
one or more resources to the more important autonomic 
component, 

wherein an autonomic component is more important for 
being at least one of a necessary data collection device, 
a carrier of a scientific instrument, a carrier of an optical 
component, an unique component, or the like, and 

wherein an autonomic component is less important for at 
least one of being damaged, not carrying a necessary 
data collection device, not carrying a scientific instru- 
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ment, not carrying an optical component, being a dupli- 
cate component, not being an unique component, or the 
like. 

20. The autonomic system of claim 19, wherein the self- 
sacrifice procedure further comprises self-destructing after 
donating one or more resources to the more important auto- 
nomic component, wherein an autonomic component is more 
important for being at least one of a necessary data collection 
device, a carrier of a scientific instrument, a carrier of an 
optical component, a unique component, or the like. 

21. The autonomic system of claim 19, wherein the one or 
more resources comprises one or more power provisions. 

22 . The system of claim 21 , wherein the one or more power 
provisions comprises at least one of a fuel cell, a fuel, a rocket, 
a rocket booster, a solar panel, a solar sail, a catalyst, a 
reactant, a reactor, an engine, a motor, a thruster, a drive, a 
magnet, and a combination thereof. 

23. The autonomic system of claim 19, wherein the plural- 
ity of autonomic components comprises one or more space 
exploration vehicles. 

24. A method for managing an autonomic system compris- 
ing a plurality of autonomic components, the method com- 
prising: 

generating a signal indicative of a need for a resource 
pertaining to a more important autonomic component of 
a plurality of autonomic components; and causing at 
least one less important autonomic component of the 
plurality to decide to undergo a voluntary self-sacrifice 
procedure based on receiving the signal indicative of a 
need for a resource, wherein the voluntary self-sacrifice 
procedure comprises determining whether a needed 
resource is available that could be donated to the more 
important autonomic component, and donating the 
needed resource to the more important autonomic com- 
ponent, 

wherein an autonomic component is more important for 
being at least one of a necessary data collection device, 
a carrier of a scientific instrument, a carrier of an optical 
component, an unique component, or the like, and 
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wherein an autonomic component is less important for at 
least one of being damaged, not carrying a necessary 
data collection device, not carrying a scientific instru- 
ment, not carrying an optical component, being a dupli- 
5 cate component, not being an unique component, or the 
like. 

25. The method of claim 24, wherein the voluntary self- 
sacrifice operation comprises donating a power provision to 
the more important autonomic component, wherein an auto- 
nomic component is more important for being at least one of 
a necessary data collection device, a carrier of a scientific 
instrument, a carrier of an optical component, an unique 
component, or the like. 

26. The method of claim 25, wherein the power provision 
comprises one or more of a fuel cell, a fuel, a rocket, a rocket 

15 booster, a solar panel, a solar sail, a catalyst, a reactant, a 
reactor, an engine, a motor, a thruster, a drive, a magnet, and 
a combination thereof. 

27. The method of claim 24, wherein the voluntary self- 
sacrifice operation comprises determining whether the 

20 resource, available for donation, is compatible with the more 
important autonomic component, wherein an autonomic 
component is more important for being at least one of a 
necessary data collection device, a carrier of a scientific 
instrument, a carrier of an optical component, an unique 
23 component, or the like. 

28. The method of claim 24, wherein the voluntary self- 
sacrifice operation comprises determining whether it is safe 
to self-destruct immediately at present location. 

29. The method of claim 24, wherein the voluntary self- 
3< 1 sacrifice procedure comprises determining that it is not safe to 

self-destruct immediately at present location, moving to a 
safe location for self-destruction, and self-destructing at the 
safe location. 

30. The method of claim 24, wherein the voluntary self- 
35 sacrifice procedure comprises tethering or docking to the 

more important autonomic component and connecting or 
transferring a power provision to the more important auto- 
nomic component. 





